Fix authenticated redirect loops when no organization resolves

app/events/page.tsx

@@ -1,7 +1,5 @@
-import { headers } from "next/headers";
-import { redirect } from "next/navigation";
 import EventsPageClient from "@/components/events/EventsPageClient";
-import { auth } from "@/lib/auth";
+import { redirectIfNotMember } from "@/lib/authUtils";
 import EventService from "@/lib/services/EventService";
 import { MembersService } from "@/lib/services/MemberService";
 
@@ -15,28 +13,15 @@ interface EventsPageProps {
 }
 
 export default async function EventsPage({ searchParams }: EventsPageProps) {
-  const session = await auth.api.getSession({
-    headers: await headers(),
-  });
-
-  if (!session?.user) {
-    redirect("/login");
-  }
-
-  const organizationId = session.session.activeOrganizationId;
-  if (!organizationId) {
-    redirect("/");
-  }
+  const session = await redirectIfNotMember();
+  const { organizationId } = session;
 
   const membership = await MembersService.findByUserAndOrganization(
     session.user.id,
     organizationId,
   );
-  if (!membership) {
-    redirect("/");
-  }
 
-  const isAdmin = MembersService.isAdminOrOwner(membership.role);
+  const isAdmin = MembersService.isAdminOrOwner(membership?.role);
   const search = await searchParams;
   const query = Array.isArray(search?.query) ? search.query[0] : search?.query;
   const filterParam = Array.isArray(search?.filter)

app/joinrequeststatus/page.tsx

@@ -15,7 +15,7 @@ import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import {
   createJoinRequestIfNeeded,
-  getActiveOrganizationIdFromHeaders,
+  requireOrganizationOrRedirect,
 } from "@/lib/authUtils";
 import { JoinRequestStatus } from "@/lib/schema";
 import { JoinRequestsService } from "@/lib/services/JoinRequestService";
@@ -194,9 +194,7 @@ export default async function JoinRequestStatusPage() {
   if (!session?.user) redirect("/login");
 
   const userId = session.user.id;
-  const organizationId =
-    await getActiveOrganizationIdFromHeaders(requestHeaders);
-  if (!organizationId) redirect("/");
+  const organizationId = await requireOrganizationOrRedirect(requestHeaders);
   const activeOrgId = organizationId;
 
   const membership = await MembersService.findByUserAndOrganization(

app/organization-not-found/page.tsx

@@ -0,0 +1,11 @@
+export default function OrganizationNotFoundPage() {
+  return (
+    <main className="flex min-h-screen flex-col items-center justify-center gap-4 bg-white px-6 text-center">
+      <h1 className="text-grey-text-strong">Organization not found</h1>
+      <p className="text-desktop-paragraph-1 text-grey-text-weak">
+        Check the spelling of your organization&rsquo;s address, or ask whoever
+        sent you the link.
+      </p>
+    </main>
+  );
+}

app/page.tsx

@@ -1,9 +1,6 @@
-import { redirect } from "next/navigation";
 import { redirectIfNotMember } from "@/lib/authUtils";
 import { MembersService } from "@/lib/services/MemberService";
-import { JoinRequestsService } from "@/lib/services/JoinRequestService";
 import { OrganizationConfigService } from "@/lib/services/OrganizationConfigService";
-import { JoinRequestStatus } from "@/lib/schema";
 import DashboardGrid from "@/components/dashboard/DashboardGrid";
 
 export const metadata = {
@@ -18,16 +15,6 @@ export default async function Page() {
     session.user.id,
     organizationId,
   );
-  if (!membership) {
-    const joinRequest = await JoinRequestsService.findByUserAndOrganization(
-      session.user.id,
-      organizationId,
-    );
-    if (joinRequest?.status === JoinRequestStatus.Pending) {
-      redirect("/joinrequeststatus");
-    }
-  }
-
   const isAdmin = MembersService.isAdminOrOwner(membership?.role) ?? false;
   const layout = isAdmin
     ? await OrganizationConfigService.getAdminDashboardLayout(organizationId)

lib/authUtils.ts

@@ -1,3 +1,4 @@
+import { ORGANIZATION_NOT_FOUND_PATH } from "@/lib/organizationRoutes";
 import type { Context } from "hono";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
@@ -217,6 +218,13 @@ export async function getActiveOrganizationIdFromHeaders(
   return organization.id;
 }
 
+/** Resolves a real organization or stops at the unguarded missing-org page. */
+export async function requireOrganizationOrRedirect(headerList: Headers) {
+  const organizationId = await getActiveOrganizationIdFromHeaders(headerList);
+  if (!organizationId) redirect(ORGANIZATION_NOT_FOUND_PATH);
+  return organizationId;
+}
+
 /**
  * Loads the Better Auth session for a Next.js server request. Redirects to
  * `/login` when there is no signed-in user.
@@ -241,12 +249,7 @@ export async function redirectIfNotMember() {
   const requestHeaders = await headers();
   const session = await requireSessionOrRedirect(requestHeaders);
 
-  const organizationId =
-    await getActiveOrganizationIdFromHeaders(requestHeaders);
-
-  if (!organizationId) {
-    redirect("/");
-  }
+  const organizationId = await requireOrganizationOrRedirect(requestHeaders);
 
   const membership = await MembersService.findByUserAndOrganization(
     session.user.id,

lib/navbar.ts

@@ -1,3 +1,4 @@
+import { ORGANIZATION_NOT_FOUND_PATH } from "@/lib/organizationRoutes";
 import type { IconName } from "@/components/bog/BogIcon/BogIcon";
 import { OrganizationConfigKey, ToggleableOrganizationFeature } from "./schema";
 
@@ -47,6 +48,7 @@ export const NAVBAR_ITEMS: NavbarItem[] = [
 ];
 
 export const NO_NAVBAR_PAGES = [
+  ORGANIZATION_NOT_FOUND_PATH,
   "/login",
   "/signup",
   "/joinrequeststatus",

lib/organizationRoutes.ts

@@ -0,0 +1 @@
+export const ORGANIZATION_NOT_FOUND_PATH = "/organization-not-found";

tests/unit/lib/authUtils.test.ts

@@ -1,3 +1,9 @@
+// @vitest-environment node
+import OrganizationNotFoundPage from "@/app/organization-not-found/page";
+import { renderToStaticMarkup } from "react-dom/server";
+import DashboardPage from "@/app/page";
+import EventsPage from "@/app/events/page";
+import JoinRequestStatusPage from "@/app/joinrequeststatus/page";
 import { randomUUID } from "node:crypto";
 import { and, eq } from "drizzle-orm";
 import { beforeEach, describe, expect, it, vi } from "vitest";
@@ -343,3 +349,69 @@ describe("auth guard helpers", () => {
     expect(mockRedirect).not.toHaveBeenCalled();
   });
 });
+
+describe("pages with no resolvable organization", () => {
+  it.each([
+    ["/", () => DashboardPage()],
+    ["/events", () => EventsPage({ searchParams: Promise.resolve({}) })],
+    ["/joinrequeststatus", () => JoinRequestStatusPage()],
+  ] as const)(
+    "%s reaches a terminal destination",
+    async (_path, renderPage) => {
+      const { headers } = await signUpAndGetSession(buildTestUser());
+      mockHeaders.mockReturnValue(
+        new Headers({ cookie: headers.Cookie, host: buildHost("missing") }),
+      );
+      await expect(renderPage()).rejects.toThrow(
+        "NEXT_REDIRECT:/organization-not-found",
+      );
+    },
+  );
+});
+
+describe("organization resolution regressions", () => {
+  it("renders the terminal page without a session or redirect", () => {
+    mockHeaders.mockReset();
+    mockRedirect.mockClear();
+    const markup = renderToStaticMarkup(OrganizationNotFoundPage());
+    expect(markup).toContain("Check the spelling");
+    expect(mockHeaders).not.toHaveBeenCalled();
+    expect(mockRedirect).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["/", () => DashboardPage()],
+    ["/events", () => EventsPage({ searchParams: Promise.resolve({}) })],
+  ] as const)(
+    "%s still admits members through the host fallback",
+    async (_path, renderPage) => {
+      const org = await createOrganization("member-org");
+      const { user, headers } = await signUpAndGetSession(buildTestUser());
+      await addMember(user.id, org.id, "member");
+      mockHeaders.mockReturnValue(
+        new Headers({ cookie: headers.Cookie, host: buildHost("member-org") }),
+      );
+      await expect(renderPage()).resolves.toBeDefined();
+    },
+  );
+
+  it.each([
+    ["/", () => DashboardPage()],
+    ["/events", () => EventsPage({ searchParams: Promise.resolve({}) })],
+  ] as const)(
+    "%s still sends nonmembers to join request status",
+    async (_path, renderPage) => {
+      await createOrganization("nonmember-org");
+      const { headers } = await signUpAndGetSession(buildTestUser());
+      mockHeaders.mockReturnValue(
+        new Headers({
+          cookie: headers.Cookie,
+          host: buildHost("nonmember-org"),
+        }),
+      );
+      await expect(renderPage()).rejects.toThrow(
+        "NEXT_REDIRECT:/joinrequeststatus",
+      );
+    },
+  );
+});